/mandos/trunk

To get this branch, use:
bzr branch /loggerhead/mandos/trunk
638 by Teddy Hogeborn
Add systemd service support for Mandos server.
1
[Unit]
2
Description=Server of encrypted passwords to Mandos clients
734 by Teddy Hogeborn
* mandos.service ([Unit]/Documentation): New.
3
Documentation=man:intro(8mandos) man:mandos(8)
787 by Teddy Hogeborn
Depend on Avahi and the network in the server's systemd service file.
4
## If the server is configured to listen to a specific IP or network
5
## interface, it may be necessary to change "network.target" to
6
## "network-online.target".
7
After=network.target
8
## If the server is configured to not use ZeroConf, these two lines
9
## become unnecessary and should be removed or commented out.
10
After=avahi-daemon.service
887 by Teddy Hogeborn
"RequisiteOverridable" is deprecated in systemd unit files
11
Requisite=avahi-daemon.service
638 by Teddy Hogeborn
Add systemd service support for Mandos server.
12
13
[Service]
787 by Teddy Hogeborn
Depend on Avahi and the network in the server's systemd service file.
14
## If the server's D-Bus interface is disabled, the "BusName" setting
15
## should be removed or commented out.
761 by Teddy Hogeborn
mandos.service: Use Type=dbus (implicitly).
16
BusName=se.recompile.Mandos
638 by Teddy Hogeborn
Add systemd service support for Mandos server.
17
ExecStart=/usr/sbin/mandos --foreground
18
Restart=always
757 by Teddy Hogeborn
mandos.service ([Service]/KillMode): Changed to "mixed".
19
KillMode=mixed
761 by Teddy Hogeborn
mandos.service: Use Type=dbus (implicitly).
20
## Using socket activation won't work, because systemd always does
21
## bind() on the socket, and also won't announce the ZeroConf service.
638 by Teddy Hogeborn
Add systemd service support for Mandos server.
22
#ExecStart=/usr/sbin/mandos --foreground --socket=0
23
#StandardInput=socket
818 by Teddy Hogeborn
Restrict the Mandos server daemon in the systemd service file.
24
# Restrict what the Mandos daemon can do.  Note that this also affects
25
# "checker" programs!
26
PrivateTmp=yes
27
PrivateDevices=yes
28
ProtectSystem=full
29
ProtectHome=yes
825 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
30
CapabilityBoundingSet=CAP_KILL CAP_SETGID CAP_SETUID CAP_DAC_OVERRIDE CAP_NET_RAW
905 by Teddy Hogeborn
Add some more restrictions to the systemd service file.
31
ProtectKernelTunables=yes
32
ProtectControlGroups=yes
638 by Teddy Hogeborn
Add systemd service support for Mandos server.
33
34
[Install]
35
WantedBy=multi-user.target